Self-supervised learning system for anomaly detection with natural language processing and automatic remediation

ABSTRACT

Systems, apparatuses and methods may provide for technology that identifies a sequence of events associated with a computer architecture, categorizes, with a natural language processing system, the sequence of events into a sequence of words, identifying an anomaly based on the sequence of words and triggering an automatic remediation process in response to an identification of the anomaly.

CROSS REFERENCE TO RELATED APPLICATION

The present application claims the benefit of priority to U.S. patentapplication Ser. No. 16/914,300 filed Jun. 27,2020.

TECHNICAL FIELD

Embodiments generally relate to detecting anomalous events based onnatural language processing and neural network processing. Moreparticularly, embodiments relate to a self-supervised learning systemthat may analyze system behavior over extended periods of time anddetect anomalous events independent of human intervention and based onnatural language processing.

BACKGROUND

Systems may log events while a computer and/or robotic system isoperating, allowing users (e.g., engineers) to identify what sequence ofevents could lead to malfunctions or errors. Standard logging mechanismsmay record event types with timestamps to record their order. Additionalinformation about the system state or event properties may also beincluded so that the additional information may be used in failurediagnostics later. Identification of errors and/or anomalous conditionsbased on such logs may be a complex problem in systems in which manyevents (e.g., thousands to millions) are generated concurrently or inparallel from several different sources. Remediation of such errorsand/or anomalous conditions may be hindered due to the time consumed toanalyze such logs which may be detrimental to system operation andmaintenance.

BRIEF DESCRIPTION OF THE DRAWINGS

The various advantages of the embodiments will become apparent to oneskilled in the art by reading the following specification and appendedclaims, and by referencing the following drawings, in which:

FIG. 1 is processes of examples of anomaly detection according to anembodiment;

FIG. 2 is a flowchart of an example of a method of translating eventsinto a language to detect anomalies according to an embodiment;

FIG. 3 is a block diagram of examples of training a natural languageprocessing system according to an embodiment;

FIG. 4 is a block diagram of examples of processing detecting andremediating an anomaly according to an embodiment;

FIG. 5A is a block diagram of an example of an industrial wirelessnetwork that includes one access point according to an embodiment;

FIG. 5B is a block diagram of an example of an industrial wirelessnetwork that includes multiple access points according to an embodiment;

FIG. 6 is a graph of an example of natural language processing responseaccording to an embodiment;

FIG. 7 is a block diagram of an example of response levels by a neuralnetwork according to an embodiment;

FIG. 8 is a graph of an example of natural language processing responsesto one or more anomalous events according to an embodiment;

FIG. 9A is a block diagram of an example of a neural network that modelsa response for packet data rates according to an embodiment;

FIG. 9B is a graph of an example of natural language processingresponses of a neural network according to an embodiment;

FIG. 10 is a flowchart of an example of a method of detecting whether ananomaly is occurring based on natural language processing according toan embodiment;

FIG. 11 is a flowchart of an example of a method of detecting whether ananomaly is occurring based on domain specific language rules accordingto an embodiment;

FIG. 12 is a flowchart of an example of a method of detecting whether aquality-of-service and/or packet data rate are anomalous according to anembodiment;

FIG. 13 is a block diagram of an example of a computing system accordingto an embodiment;

FIG. 14 is an illustration of an example of a semiconductor apparatusaccording to an embodiment;

FIG. 15 is a block diagram of an example of a processor according to anembodiment; and

FIG. 16 is a block diagram of an example of a multi-processor basedcomputing system according to an embodiment.

DESCRIPTION OF EMBODIMENTS

Turning now to FIG. 1, an anomaly detection process 100 is illustrated.In detail, an event processing system 124 (e.g., a computing device) mayinclude machine learning (e.g., a neural network) to appreciate andharness natural language processing of events in computer architectures.For example, the event processing system 124 may treat the events aswords in a natural language and learn the structure and meaning of thelanguage by training a natural language-based processing (NLP) system topredict events (e.g., similar to predicting words in a sentence).Anomalies may be detected when low probability sequences of words areencountered (e.g., an unexpected sentence is formed by wordscorresponding to the events) and/or when a sentence corresponding to aloss in quality (e.g., hardware device errors or diminished return) isidentified. Anomalies may be flagged as low probability events totrigger remediation actions by an automated system such as the eventprocessing system 124.

The event processing system 124 may provide an overall enhancement toperformance of existing products and accelerate product development anddebugging due to the efficient and enhanced identification of anomalies,and remediation of the anomalies. Moreover, some embodiments mayidentify and remove errors, solve serious problems, and automaticallyremediate (e.g., with no human intervention) issues in robotic andcomputer architectures to enhance user safety, user experience,efficiency and success. For example, some embodiments may be drawn to adevelopment and execution process of a complex software product. Theevent processing system 124 may analyze failed logs of the softwareproduct to identify specific portions of the software product that causefailure and remediate those portions (e.g., modify the computer code ofthe software product).

Some embodiments may be drawn hardware implementations. For example,some embodiments may be drawn to a development and execution process ofa hardware based product. The event processing system 124 may analyzefailed and/or successful logs of the hardware product to identifyimplementations of the hardware product that cause failure and remediatethose portions (e.g., utilize different hardware elements to executesome processes, reprogram configurable logic, etc.). In detail, someembodiments may be drawn to ensuring reliable communications in awireless network. The event processing system 124 may analyzecommunications between the wireless network and insert commands (e.g.,events) to remediate potential anomalies.

In some embodiments, the event processing system 124 may be trained todefine a unique vocabulary (e.g., words identified from log events) anddomain specific language (e.g., syntax rules, semantics, grammaticalstructure, probabilities of words occurring proximate each other,dependencies between events or words, etc.) for a particulararchitecture and/or process. For example, the event processing system124 may define the domain specific language with words present in logstatements in code, and the rules may be derived from the expectedorders of those words in a successful execution log (e.g., processoccurs without anomaly and to achieve a specific goal). The expectedgrammatical structure may be defined by the type of events associatedwith the execution environment 102 and the order in which the eventstypically occur in the execution environment 102. The domain specificlanguage may be generated specifically for the execution environment102. In some embodiments, the event processing system 124 may be aneural network that is trained on a body of data. In this example, theparticular architecture and/or process is the execution environment 102.The execution environment 102 may be any environment, such as an indoorindustrial wireless network, a computing device executing source code, awireless network, a processing environment to deploy software fordebugging, etc.

The execution environment 102 may generate an event record 102 a. Theevent record 102 a may be a series of events, a log of the events,readings from devices (e.g., readings from network devices), etc. Theevents may correspond to execution of processes in the executionenvironment 102. For example, the events may be measurements or commandsof the processes.

The event processing system 124 may access the event record 102 a. Forexample, the event processing system 124 may receive periodic updatesfrom the execution environment 102, updates every time a new event inthe execution environment 102 occurs, and/or read the event record 102 awhen triggered.

The event processing system 124 may categorize the events of the eventrecord 102 a into words 106 based on natural language processing 104(e.g., the neural network may identify the words). For example, theevent processing system 124 may execute an automated process thatextracts unique words or events (e.g., code execution snippets, readingsfrom devices, etc.) from the event record 102 a (e.g., a log) and storesthe words 106 into a local data structure (e.g., memory). The automatedprocess may be executed over the entire event record 102 a to identifythe words 106. Thus, the event processing system 124 may substitutewords 106 for events that occur in a system execution session.

The event processing system 124 may further form sentences from thewords 106 and based on natural language processing. For example, theevent processing system 124 (e.g., with an NLP system) may attempt toinfer structure or meaning from a string of the words 106 based on thedefined vocabulary and rules of the domain specific language. In otherwords, the event processing system 124 may attempt to generate a propergrammatical sentence according to the domain specific language and mayfurther attempt to predict words (e.g., corresponding to events) in thesentence. If the event processing system 124 is unable to inferstructure and/or meaning from some anomalous events (reflected asanomalous words in a sentence), the event processing system 124 adjustan output (e.g., lower activation) accordingly to reflect that thestructure and meaning is unable to be inferred.

For example, if the event processing system 124 is able to inferstructure or meaning from the words 106, the event processing system 124may be able to predict a next word (corresponding to an event) in thesentence (corresponding to a series of events). If the event processingsystem 124 cannot predict a next word in a sentence (or the next word inthe sentence is unexpected), an anomalous condition may be occurring(e.g., a situation in which normal execution is being interruptedresulting in a sequence of unusual events and corresponding words).

Sentences that do not follow normal syntax may be categorized asunexpected sentence and stored as anomalous sentences 114, whilesentences that do follow normal syntax may be categorized asnon-anomalous sentences 110 (e.g., sentences that represent a deviationfrom an expected behavior). Thus, an expected sentence may generallyrepresent temporal sequences of events (e.g., words), in a particulargrammatical structure (e.g., order with some permutations allowed). Theexpected grammatical structure of the expected sentences is defined bythe type of events associated with the expected sentences and the orderin which the events typically occur.

As noted, in some embodiments, the event processing system 124 mayinclude a neural network to identify sentences and provide responses(e.g., response levels) based on the sentences. The neural network mayhave a response (e.g., response level) that is based on the probabilityof an event (e.g., word) occurring, and whether the event actuallyoccurs. For example, given a prior three words (corresponding to threeevents) in a sentence, the neural network may predict a fourth word(prior to a fourth event being processed) will follow in the sentence.An example is as follows in the following sentence word 1, word 2, word3, predicted word 4. Thereafter, the event processing system 124 mayreceive the fourth event. If the event processing system 124 translatesthe fourth event into the “word 4” based on natural language processing,the sentence may be expected. If, however the fourth event does notcorrespond to the fourth word (e.g., corresponds to a word 5), thesentence may be deemed unexpected since the sentence has the structureof word 1, word 2, word 3, word 5.

In some embodiments, more than one word may be predicted. For example,suppose that the following sentence is identified word 1, word 2, word3. The event processing system 124 may predict that predicted word 4 andpredicted word 6 are likely to occur based on word 1, word 2, word 3(e.g., predicted word 4 may have a probability of occurring above athreshold, and predicted word 6 may have a probability of occurringabove the threshold). Thereafter, the event processing system 124 mayreceive the fourth event. If the event processing system 124 translatesthe fourth event into the “word 6” or “word 4” based on the naturallanguage processing described above, the sentence may be expected. If,however the fourth event does not correspond to the fourth word (e.g.,corresponds to a word 5), the sentence may be deemed unexpected sincethe sentence has the structure of word 1, word 2, word 3, word 5.

In some embodiments, if the neural network is unable to predict a nextword (neural network cannot predict a word that has a high enoughprobability of occurring and/or is consistently incorrect inpredictions) based on a series of prior words, the sentence may bedeemed unexpected and unpredictable. In such cases, the response (e.g.,a response level) of the neural network may be low (unable to find asuitable next word to cause a low response level). When the neuralnetwork is able to predict a word with high probability the neuralnetwork may be deemed to have a maximized response (e.g., response levelis high). Thus, the neural network may be trained to provide responselevels based on expected or unexpected sentences (e.g., output lowresponse level when unexpected sentences occur indicating an anomaly isdetected in response to unexpected behaviors and output high responselevel when sentences are expected and there is no anomaly).

In some embodiments, the event processing system 124 may conduct aquality-of-service analysis based on the words 106. For example, theevent processing system 124 may predict a quality-of-service (e.g.,packet data rate) of the execution environment 102 based on identifiedsentences. If a sentence corresponds to the quality-of-servicedegrading, the event processing system 124 may classify the sentence asan anomalous sentence 114 and output a corresponding activation energy.

The event processing system 124 may thus form sentences from words 106based on natural language processing 108 to form non-anomalous sentences110 (which may be represented by activation energies in the NLP system)and an anomalous sentence 114 (represented by activation energies). Asnoted, the anomalous sentence 114 may be unpredictable sentences,sentences in which words 106 logically would be unlikely to follow eachother, and/or sentences that indicate a degradation of thequality-of-service (e.g., a sentence may be identified as correspondingto a drop in quality-of-service).

Thus, in some embodiments, the event processing system 124 may includethe NLP system that is trained to only respond strongly to sentencesassociated with expected events (e.g., expected sentences).Additionally, the event processing system 124 may be trained to exhibitstrong responses to sentences containing the same sets of events whilepreserving local coherence in the events. The event processing system124 may identify potential situations that lead to anomalies or systemfailures by measuring a level of responses (e.g., by the NLP system) andtrigger a remediation action when the level of responses is below athreshold (e.g., response meets the threshold). For example, the NLPsystem may measure the level of responses in the implemented languagenetwork, where expected groups of events generate a higher response inthe neural network where, and anomalous sentences represents lowerresponse in the network.

In some embodiments, the NLP system may be trained (e.g., trained todetect anomalies) to increase the response level in response toanomalous sentences 114 (e.g., sentences that cause a loss inquality-of-service increased response level when an unexpected sentenceor unexpected behavior occurs). Thus, in some embodiments, if theresponse level of the NLP increases above a threshold (e.g., responsemeets the threshold), an automatic remediation may be triggered toremediate a drop in quality-of-service.

The event processing system 124 may predict an anomaly 118 based on theanomalous sentence 114, 116 and/or the level of responses meeting athreshold. For example, the anomaly may be detected when the responselevel increases above a threshold in some embodiments (e.g., when theNLP is trained to increase the response level when a sentence occursindicating an anomaly) or when the response level decreases below athreshold (e.g., when the NLP is trained to decrease the response levelwhen an unexpected sentence occurs indicating an anomaly). The anomaly118 may be analyzed and stored. Further, after the anomaly 118 isdetected, the event processing system 124 may trigger a remediationprocess (or execute the remediation process) to remedy the anomaly 118,120 to adjust systems 122. For example, the event processing system 124may rollback system code, break local coherence of a sequence of events,utilize different wireless channels for communication, adjust hardwareparameters and so forth. In some embodiments, the event processingsystem 124 may adjust to one or more of a hardware parameter or adjust asoftware parameter to remediate the anomaly.

Thus, some embodiments may provide an enhanced system and method todetect errors, mitigate errors and respond to errors based on naturallanguage processing. Some embodiments may substantially reduce reactiontimes to errors and allow for enhanced operation and safety.

FIG. 2 shows a method 300 of translating events into a language todetect anomalies. The method 300 may generally be implemented in an NLPand remediation architecture such as, for example, the event processingsystem 124 (FIG. 1), already discussed. In an embodiment, the method 300is implemented in one or more modules as a set of logic instructionsstored in a machine- or computer-readable storage medium such as randomaccess memory (RAM), read only memory (ROM), programmable ROM (PROM),firmware, flash memory, etc., in configurable logic such as, forexample, programmable logic arrays (PLAs), field programmable gatearrays (FPGAs), complex programmable logic devices (CPLDs), infixed-functionality logic hardware using circuit technology such as, forexample, application specific integrated circuit (ASIC), complementarymetal oxide semiconductor (CMOS) or transistor-transistor logic (TTL)technology, or any combination thereof.

For example, computer program code to carry out operations shown in themethod 300 may be written in any combination of one or more programminglanguages, including an object oriented programming language such asJAVA, SMALLTALK, C++ or the like and conventional procedural programminglanguages, such as the “C” programming language or similar programminglanguages. Additionally, logic instructions might include assemblerinstructions, instruction set architecture (ISA) instructions, machineinstructions, machine dependent instructions, microcode, state-settingdata, configuration data for integrated circuitry, state informationthat personalizes electronic circuitry and/or other structuralcomponents that are native to hardware (e.g., host processor, centralprocessing unit/CPU, microcontroller, etc.).

Illustrated processing block 302 identifies a sequence of eventsassociated with a computer architecture. Illustrated processing block304 categorizes, with a natural language processing system, the sequenceof events into a sequence of words. For example, processing block 304may identify words from the sequence of events based on a vocabularyassociated with the computer architecture, arrange the identified wordsinto the sequence of words and generate at least one sentence based onthe words. In some embodiments, the natural language processing systemis one or more neural networks.

Illustrated processing block 306 identifies an anomaly based on thesequence words. In some embodiments, processing block 306 identifies theanomaly based on the at least one sentence. For example, processingblock 306 may conduct a determination that the at least one sentence isto be dissimilar from any sentence structure defined by a domainspecific language associated with the computer architecture and identifythe anomaly based on the determination. Illustrated processing block 308triggers an automatic remediation process in response to anidentification of the anomaly.

In some embodiments, the method 300 may generate a level of responsebased on the sequence of words, wherein the level of response associatedwith a quality-of-service measurement, and identify the anomaly based onthe level of response meeting a threshold. Further, in some embodiments,the anomaly is a deviation from an expected behavior, and the automaticremediation process includes an adjustment to one or more of a hardwareparameter or an adjustment to a software parameter.

The method 300 may provide a process to detect errors. For example, themethod 300 may apply unique vocabulary, semantic, logic and/or syntaxrules to the events to identify whether a sequence of events may lead todetrimental performance. The method 300 may mitigate errors and respondto errors based on natural language processing. Some embodiments maysubstantially reduce reaction times to errors and allow for enhancedoperation and safety through enhanced identification of such errors andmitigation thereof.

FIG. 3 illustrates an NLP system learning and training process 350. Theprocess 350 may be implemented to train for example, the eventprocessing system 124 (FIG. 1), and/or to implement aspects of themethod 300 (FIG. 2) already discussed. A software code base 352 and testexecution logs 354 may be provided as inputs into the learning andtraining process 350. The NLP system 360 may be a neural network thatwill be trained to identify anomalous events.

The process 350 may include creating a Domain Specific Language (DSL)definitions 358 that gives structure and meaning to expected events thatoccur during normal functioning of a system under consideration andassociated with the test execution logs 354. A DSL may be generated forany system that generates logs, by defining a Language Vocabulary and bytraining the NLP system 360 to give structure and meaning to log events.In some embodiments, the log events may be produced by a system runningunder normal conditions (e.g., no anomalies). The NLP system 360 may usethe DSL 358 to translate from a log of events to sentences of words.

For example, in a software development scenario, log artifactsdescribing various system events may be produced by successful testexecution sessions. The temporal correlation of these events mayrepresent the body of expected events in the system. The NLP system 360may reference timestamps to identify the temporal correlations. The NLPsystem 360 may be trained to identify “sentence structures” based on thetemporal correlations. For example, the “sentence structures” may bedetermined by neural network layers of the NLP system 360. The “sentencestructures” may not be formally defined, but the NLP system 360 may betrained to learn probabilities between words and thus, if a sentencebelongs to the language or not. The NLP system 360 may further, based onthe temporal correlations, identify expected interactions and statetransitions between different log events in the test execution log 354.The NLP system 360 may handle events that are expressed in diverseformats following a non-predefined structure (e.g., similar tovariations in syntax and semantics of the natural human language).

In some embodiments, events in a wireless network associated with a lossin quality of service (QoS) such as packet delivery rate (PDR) may bemonitored. The test execution logs 354 may be logs associated with dropsin the received signal strength indicator (RSSI) collected fromdifferent stations (STA), increase in the frequency selectivity of thewireless links through the analysis of the collected channel stateinformation, or the health of the wireless interfaces used to connectstations to access points. The NLP system 360 may analyze the testexecution logs 354 to determine syntax and generate the DSL definitions358.

The NLP system 360 may generate language vocabulary definitions 356 togenerate a “language vocabulary” based on a software code base 352. Todo so, the NLP system 360 defines the equivalent of a word in alanguage. For example, each unique log event from the software code base352 may form a unique word in the language vocabulary. The log eventsmay be printed from the software code base 352. Timestamps generatedduring the printing may be discarded and ignored for language vocabularydefinition generation. The NLP system 360 may log events generated bylines in the software code base 352. An automated process may be used toextract the unique words from the software code base 352 (e.g., throughprinting to logs and analysis of the logs). To form a complete languagevocabulary, the automated process may be executed over the entiresoftware code base 352. Upon completion, the NLP system 360 may generatea language vocabulary that contains a complete list of possible wordsthat may be found in any log produced by the software, and store thelanguage vocabulary as the language vocabulary definitions 356.

In some embodiments, words may be represented by readings collected bymultiple network devices. For instance, each station in the network mayhave a vocabulary formed by RSSI measurements, frequency selectivity ofthe channel, line of sight presence and status of the wirelessinterface. The software code base 352 may include software codesassociated with the station, and the test execution logs 354 may includelogs from the station.

The NLP system 360 may thus generate the language vocabulary definitions356 and the DSL definitions 358 to execute a training process. Forexample, given the language vocabulary definitions 356 and a set of logsobtained during normal system conditions, the NLP system 360 mayautomatically generate the DSL definitions 358 by converting each eventinto a unique statement in the DSL.

In some embodiments, the NLP system 360 may be trained in aself-supervised manner (e.g., self-supervised learning) based on the DSLdefinitions 358 and the language vocabulary definitions 356. That is,data labels may not be necessary for self-supervised training orlearning. Instead, the NLP system 360 may analyze a portion of asequence of events to predict a missing event. In doing so, the NLPsystem 360 may learn the temporal correlations and dependencies betweenevents in a sequence (e.g., between words in the Domain SpecificLanguage). The NLP system 360 may be any number of neural networkarchitectures (e.g., recurrent neural network and/or a transformerarchitecture) that model natural languages and capture multipletimescales of information.

After training, the NLP system 360 may respond maximally if the NLPsystem 360 is presented with sentences that correspond to an expectedset of events. By analogy to language, this may be understood as the NLPsystem 360 inferring structure or meaning from a string of words to forma cohesive and logical sentence (e.g., an expected arrangement ofwords). In some embodiments, if the NLP system 360 is unable to inferstructure or meaning from some anomalous events presented as words in asentence (e.g., does not form a cohesive and logical sentence), the NLPsystem 360 may have a lower activation.

For example, the NLP system 360 may predict a next event after a firstevent (e.g., Event 1) based on the learning and training process 350.Event 2 may be predicted as the next event, given that it has thehighest probability of being present after Event 1. If Event 2 isidentified as actually having occurred, the NLP system 360 may trigger amaximized response. In an anomaly scenario, the NLP system 360 mayprocess an event which has a low probability of occurrence consideringthe previous received events. The event processing continues, until theNLP system module cannot effectively predict the next event (all of themhas a low probability distribution) and an anomaly is identified.

If quality-of-service of a hardware device (e.g., PDR) is to be modeled,instead of predicting what the next event is going to be, the naturallanguage processing system 360 may predict a maximum quality-of-service(e.g., PDR in the whole network), and provide a maximized response whenthe quality-of-service drops below a threshold. The natural languageprocessing system 360 may execute similarly as to described above.

In some embodiments, the NLP system 360 responds highly to log eventsequences that have a local permutations. For example, sentences maystill be meaningful when the order of nearby words is switched. Suchimplementations may be referred to as acceptable local combinability.The NLP system 360 may thus provide consistent analysis (e.g.,activations) even if the order of events changes. In some embodiments,even if the order of the events changes, the order of events maymaintain an acceptable local combinability (e.g., flexible sentencestructures are permitted). This flexibility in the NLP system 360reduces false positives in anomaly detection. Thus, even though theorder of the events may be different between logs, the NLP system 360may still treat the logs similarly (e.g., output a strong response) andmaintain an acceptable local combinability. Both these logs will stillelicit a maximal response from the NLP system 360.

In some embodiments, the occurrence of events preserving local coherencemay produce the same end results for QoS and PDR analysis. For instance,observing a drop in RSSI followed by failure of one of the WLANinterfaces may have the same effect in QoS degradation than having theevents occur in the opposite order.

FIG. 4 illustrates an anomaly detection and remediation process 362. Theprocess 362 may be implemented by the event processing system 124 (FIG.1), and/or to implement aspects of the method 300 (FIG. 2) alreadydiscussed.

The natural language processor 366 processes a failed execution log 364.In some embodiments, the failed execution log 364 may have beenpreviously processed to generate the input words and sentences. In otherembodiments, the natural language processor 366 processes the failedexecution log 364 to generate words and sentences. In this particularexample, the natural language processor 366 detects an anomaly. Thenatural language processor 366 communicates the anomalous condition tothe remediation system 368. The remediation system 368 may producemodified parameters 370. For example, the remediation system 368 mayexecute an automated software version revert mechanism to remediate theanomalous condition. Additionally, the Remediation System 368 may mapthe anomalous condition to specific sections of a software code base.The map may be presented to a human via a display for correction or anautomatic process may correct and modify the software code base.

FIG. 5A illustrates an example of an industrial wireless network 380that includes a wireless access point 390 connected to a computingdevice 386, vehicles 382 and robotic arm 384. The already describedevent processing system 124 (FIG. 1), method 300 (FIG. 2), naturallanguage processing system 360 (FIG. 3), natural language processor 366(FIG. 4) and/or remediation system 368 (FIG. 4) may analyze the network380 to identify anomalies and remediate the anomalies.

As already noted, some embodiments may pertain to analyzing events(relating to quality of service and packet delivery rate) in a wirelessenvironment and detecting anomalous events that correspond to a loss inQoS such as PDR. The PDR and QoS may pertain to communications betweenthe wireless access point 390 connected to a computing device 386,vehicles 382 and robotic arm 384.

In such embodiments, a NLP system may include a DSL that is designed bycollecting logs associated with drops in the received signal strengthindicator (RSSI) collected from different stations, such as thecomputing device 386, vehicles 382 and robotic arm 384, increase in thefrequency selectivity of the wireless links through the analysis of thecollected channel state information, or the health of the wirelessinterfaces used to connect stations to access point 390. Thereafter, theNLP system may analyze the network 380 for anomalous events.

For example, the following words in the industrial sentence may beformed based on event logs between the robotic arm 384 and the wirelessaccess point 390. In the below exemplary sentence, STA1 (STA as usedherein refers to station) corresponds to the robotic arm 384 and AP1corresponds to wireless access point 390: “[STA1, WLAN, on],[STA1, RSSI,−52 dBm],[STA1-AP1, LOS],[STA 1-API, UL], [STA1-AP1, BE].” This sentenceindicates that the robotic arm 384 (i.e., STA1) has a WLAN interface on,with received RSSI −52 dBm. The sentence further indicates that therobotic arm 384 (i.e., STA1) is connected to wireless access point 390(i.e., AP1) and has line of sight (LOS) with wireless access point 390(i.e., AP1). Finally, the sentence indicates an uplink (UL) transmissionis of best effort network traffic.

FIG. 5B is an example of an industrial wireless network 398 thatincludes multiple wireless access points 396, 394 connected to a roboticarm 392. The already described event processing system 124 (FIG. 1),method 300 (FIG. 2), natural language processing system 360 (FIG. 3),natural language processor 366 (FIG. 4) and/or remediation system 368(FIG. 4) may analyze the network 398 to identify anomalies and remediatethe anomalies.

As already noted, some embodiments may pertain to analyzing events(relating to QoS and PDR) in a wireless environment and detectinganomalous events that correspond to a loss in QoS such as PDR.

In some embodiments, remediation may be achieved by breaking a localcoherence of sequence of events causing a drop in PDR or QoS. Forinstance, suppose that the following sentence results in a low PDR:[STA1, WLAN, off], [STA1, WLAN2, on], [STA-AP1 RSSI ??], [STA-AP2RSSI-92 dBm]. In the previous sentence, STA1 corresponds to robotic arm392, AP1 corresponds to access point 394 and AP2 corresponds to accesspoint 396.

In some embodiments, a remediation system (as described herein) mayactively insert new events to prevent the above sentence from occurringand based on an identification that the PDR may drop after the thirdevent. For example, by adding the event [AP2, tx-up] between the thirdand fourth event, the RSSI may be increased and the QoS preserved. Thatis, the following sentence may result in an acceptable PDR: [STA1, WLAN,off], [STA1, WLAN2, on], [STA-AP1 RSSI ??], [AP2, tx-up], [STA-AP2RSSI-92 dBm]. Thus, the remediation system may actively track potentialanomalies and insert instructions to avoid the anomalies.

FIG. 6 is a graph 400 illustrating an NLP response (along the y-axis)for two different response curves 402, 404 over events (along x-axis).The NLP response may be associated with (e.g., output by) the alreadydescribed event processing system 124 (FIG. 1), method 300 (FIG. 2),natural language processing system 360 (FIG. 3) and/or natural languageprocessor 366 (FIG. 4).

In FIG. 6, the response curve 402 corresponds to an expected sentencethat maximizes the response. The response curve 404 is an unexpectedsentence that generates high responses on the initial events, butreduces greatly when the subsequent events are unexpected. This lowerresponse represents anomalies.

FIG. 7 shows an example of responses levels 420 by a neural network 430of an NLP system for an expected group of events. The neural network 430may be readily operated in conjunction with or replace the eventprocessing system 124 (FIG. 1), method 300 (FIG. 2), natural languageprocessing system 360 (FIG. 3) and/or natural language processor 366(FIG. 4). The probability distribution 422, output layer 424, hiddenlayer 426 and input layer 428 may be part of the neural network 430 thatis trained as described herein for NLP of events.

Given an initial input Event1 (see bottom row), the neural network 430predicts the next event, based on the learning process described herein.The Event2 is assigned a probability distribution 422 of 0.4 and ispredicted as the next event, given that Event2 has the highestprobability of being present after Event1. The second event Event2 isthen processed by the neural network 430 and triggers a maximizedresponse since Event2 was predicted to occur. In contrast, if anotherevent occurred, meaning that the neural network 430 was incorrect in theprediction of Event2, a minimal response would be triggered. That is, inan anomaly scenario, the neural network 430 will process an event with alow probability of occurrence considering the previous received events.The event processing continues, until the neural network 430 cannoteffectively predict the next event (all of them has a low probabilitydistribution).

FIG. 8 illustrates a graph 440 of an NLP system responses 442 toanomalous events. The graph 440 may be outputs produced the eventprocessing system 124 (FIG. 1), method 300 (FIG. 2), natural languageprocessing system 360 (FIG. 3) and/or natural language processor 366(FIG. 4).

In detail, once the NLP system is trained to predict responses in a DSL,the NLP system may be integrated in an event log processing system andused for anomaly detection. A log generated by a system session thatended in an error may be presented to the NLP system. The NLP system mayprocess the sentences in a temporal order, having maximized activationto non-anomalous or typical events. For events that immediately precedethe error, the NLP system may present a lower response of the responses442, until the lowest response is reached in the error conditions. Doingso may aid in identifying which specific events cause an anomaly andremedying the anomaly during future deployments.

FIG. 9A illustrates a neural network 510 of an NLP that models aresponse for PDR. The neural network 510 may be readily substituted foror operate in conjunction with the event processing system 124 (FIG. 1),method 300 (FIG. 2), natural language processing system 360 (FIG. 3)and/or natural language processor 366 (FIG. 4). The neural network 510includes output layer 504, hidden layer 506 and input layer 508 thatoutput predicted PDRs 502. Instead of predicting what the next event isgoing to be, the neural network may predict what the maximum PDR inwhole network will be output, as indicated by the predicted PDRs 502. Asillustrated, the PDRs 502 decrease with the events1-events7. While PDRs502 are described, other parameters (e.g., hardware parameters) may bequantified as a quality-of-service metric.

FIG. 9B illustrates a graph 446 of anomaly detection being triggeredwhen an NLP response of the neural network 510 meets a predeterminedthreshold 452. The left Y-axis illustrates the NLP response and theright Y-axis is in the inverse of QoS of a computer architecture. TheQoS may be the PDR of the computer architecture (e.g., the right Y-axismay be the inverse of PDR). The X-axis is the event position. In thisparticular example, the NLP system may be trained to increase a responsewhen the QoS decreases (e.g., PDR decreases).

As noted, response levels may be mapped to the graph 446. For example,the neural network 510 (which may be a neural language processor)responses may be based on the predicted PDRs 502. As the PDRs 502decrease, the response of the neural network 510 may correspondinglyincrease. The increase in the response is illustrated in a firstresponse curve 450.

The threshold 452 may be associated with a significant drop in QoS. Thatis, FIG. 9B shows an example of the anomaly detection for positive andfalse detections. In this particular example, the first response curve450 triggers an anomaly since the response of the neural network 510increases over time above the threshold 452 and corresponds to adecrease in the QoS.

A second response curve 448 may not trigger an anomaly condition sincethe NLP response of a neural network drops below the threshold 452 asidefor event 5. In some embodiments, the NPL may be designed such that evenif the QoS is acceptable (after dropping significantly), the overallsystem is notified to identify a cause for the drop in QoS (even if thedrop was only temporary).

FIG. 10 shows a method 480 of detecting whether an anomaly is occurringbased on NLP. The method 480 may be readily implemented with the eventprocessing system 124 (FIG. 1), method 300 (FIG. 2), natural languageprocessing system 360 (FIG. 3), remediation system 368 (FIG. 4) and/ornatural language processor 366 (FIG. 4). already discussed. Moreparticularly, the method 480 may be implemented in one or more modulesas a set of logic instructions stored in a machine- or computer-readablestorage medium such as RAM, ROM, PROM, firmware, flash memory, etc., inconfigurable logic such as, for example, PLAs, FPGAs, CPLDs, infixed-functionality logic hardware using circuit technology such as, forexample, ASIC, CMOS or TTL technology, or any combination thereof.

Illustrated processing block 482 identifies an event. Illustratedprocessing block 484 categorizes the event into a word. Illustratedprocessing block 486 determines whether the word is expected based on aprevious sequence of words. For example, a neural network may identifywhether the neural network predicts that the word will occurs based onthe previous words (e.g., whether the previous words logically lead tothe word based on a probability analysis and a domain specific languagedefinition module). In some embodiments, a probability of the wordoccurring based on the previous words may be identified. For example, ifthe probability of the word occurring is above a threshold or if theneural network predicts that the word will occur, then the word may bedeemed to be expected.

If so, illustrated processing block 496 may maintain or increase aresponse level of the neural network. Otherwise, illustrated processingblock 490 may lower a response level. Illustrated processing block 492,determines if the response level is below a threshold. If not,illustrated processing block 482 may execute. Otherwise, illustratedprocessing block 494 detect an anomaly. In some embodiments, the method480 may further include remediating the anomaly in some fashion (e.g.,institute corrective measures to mitigate the anomaly).

FIG. 11 shows a method 600 of detecting whether an anomaly is occurringbased on domain specific language rules. The method 600 may be readilyimplemented with the event processing system 124 (FIG. 1), method 300(FIG. 2), natural language processing system 360 (FIG. 3), remediationsystem 368 (FIG. 4) and/or natural language processor 366 (FIG. 4),already discussed. More particularly, the method 600 may be implementedin one or more modules as a set of logic instructions stored in amachine- or computer-readable storage medium such as RAM, ROM, PROM,firmware, flash memory, etc., in configurable logic such as, forexample, PLAs, FPGAs, CPLDs, in fixed-functionality logic hardware usingcircuit technology such as, for example, ASIC, CMOS or TTL technology,or any combination thereof.

Illustrated processing block 602 identifies events. Illustratedprocessing block 604 categorizes the events into words. Illustratedprocessing block 606 forms a sentence from the words. Illustratedprocessing block 608 determines if the sentence conforms to domainspecific language rules. If so, the method 600 may continue and noanomaly is detected. If the sentence does not conform to domain specificlanguage, illustrated processing block 610 detects and anomaly. In someembodiments, the method 600 may further include remediating the anomalyin some fashion (e.g., institute corrective measures to mitigate theanomaly).

FIG. 12 shows a method 520 of detecting whether a QoS and/or PDR areanomalous (e.g., unacceptably low). The method 520 may be readilyimplemented with the event processing system 124 (FIG. 1), method 300(FIG. 2), natural language processing system 360 (FIG. 3), remediationsystem 368 (FIG. 4) and/or natural language processor 366 (FIG. 4),already discussed. More particularly, the method 480 may be implementedin one or more modules as a set of logic instructions stored in amachine- or computer-readable storage medium such as RAM, ROM, PROM,firmware, flash memory, etc., in configurable logic such as, forexample, PLAs, FPGAs, CPLDs, in fixed-functionality logic hardware usingcircuit technology such as, for example, ASIC, CMOS or TTL technology,or any combination thereof.

Illustrated processing block 522 identifies events. Illustratedprocessing block 524 categorizes the events into words. Illustratedprocessing block 528 identifies a response level of a neural networkbased on the words, the activation level being associated with qualityof service and/or PDR. Illustrated processing block 530 determines ifthe response level meets the threshold. If so, illustrated processingblock 522 identifies events. Otherwise, illustrated processing block 532detects the anomaly. In some embodiments, the method 520 may furtherinclude remediating the anomaly in some fashion (e.g., institutecorrective measures to mitigate the anomaly).

Turning now to FIG. 13, a performance-enhanced computing system 158(e.g., a computing device) is shown. The computing system 158 maygenerally be part of an electronic device/platform having computingfunctionality (e.g., personal digital assistant/PDA, notebook computer,tablet computer, convertible tablet, server), communicationsfunctionality (e.g., smart phone), imaging functionality (e.g., camera,camcorder), media playing functionality (e.g., smart television/TV),wearable functionality (e.g., watch, eyewear, headwear, footwear,jewelry), vehicular functionality (e.g., car, truck, motorcycle), etc.,or any combination thereof. In the illustrated example, the system 158includes a host processor 160 (e.g., CPU with one or more processorcores) having an integrated memory controller (IMC) 162 that is coupledto a system memory 164. The host processor 160 further includesaccelerators A₁-A₃ (although any number of accelerators may be provided)to implement a neural network. In some embodiments, the system 158 mayfurther communicate through the network controller 174 with otherelectronic devices that also implement the neural network and/or controlthe other electronic devices based on an output (e.g., response level)of the neural network.

The illustrated system 158 also includes a graphics processor 168 (e.g.,graphics processing unit/GPU) and an input output (IO) module 166implemented together with the processor 160 (e.g., as microcontrollers)on a semiconductor die 170 as a system on chip (SOC), where the IOmodule 166 may communicate with, for example, a display 172 (e.g., touchscreen, liquid crystal display/LCD, light emitting diode/LED display), anetwork controller 174 (e.g., wired and/or wireless), and mass storage176 (e.g., HDD, optical disc, SSD, flash memory or other NVM). Theillustrated SOC 170 includes a ROM 178 with logic instructions, whichwhen executed by the host processor 160 or graphics processor 160, causethe computing system 158 to implement and/or perform one or more aspectsof the process 100 (FIG. 1), method 300 (FIG. 2), process 350 (FIG. 3),process 362 (FIG. 4), neural network 430 (FIG. 7), neural network 510(FIG. 9A), method 480 (FIG. 10), method 600 (FIG. 11) and method 520(FIG. 12), already discussed.

In some embodiments, the system 158 may further include processors (notshown) and/or AI accelerator 152 dedicated to artificial intelligence(AI) and/or neural network (NN) processing. For example, the system SoC170 may include vision processing units (VPUs,) and/or otherAI/NN-specific processors, etc. In some embodiments, any aspect of theembodiments described herein may be implemented in the processors and/oraccelerators dedicated to AI and/or NN processing such as AI accelerator152, the graphics processor 168 and/or the host processor 160.

Thus, the illustrated system 158 may train a neural network to developlanguage syntax models and vocabularies for events. That is, the neuralnetwork may implement NLP to analyze events and identify whether theevents are anomalous. The neural network may provide response levelsthat correspond to anomalous events and remediate anomalous events asthe events arise. In some embodiments, the system 158 may transmit amessage to the electronic devices through the network controller 174 toinstruct the electronic devices to remediate events identified asanomalous. In some embodiments, anomalous events and associated data isdisplayed to a user on the display 172.

FIG. 14 shows a semiconductor package apparatus 180. The illustratedapparatus 180 includes one or more substrates 184 (e.g., silicon,sapphire, gallium arsenide) and logic 182 (e.g., transistor array andother integrated circuit/IC components) coupled to the substrate(s) 184.In one example, the logic 182 is implemented at least partly inconfigurable logic or fixed-functionality logic hardware. The logic 182may implement and/or perform one or more aspects of the process 100(FIG. 1), method 300 (FIG. 2), process 350 (FIG. 3), process 362 (FIG.4), neural network 430 (FIG. 7), neural network 510 (FIG. 9A), method480 (FIG. 10), method 600 (FIG. 11) and method 520 (FIG. 12), alreadydiscussed. In one example, the logic 182 includes transistor channelregions that are positioned (e.g., embedded) within the substrate(s)184. Thus, the interface between the logic 182 and the substrate(s) 184may not be an abrupt junction. The logic 182 may also be considered toinclude an epitaxial layer that is grown on an initial wafer of thesubstrate(s) 184.

In some embodiments, the logic 182 may further include processors (notshown) and/or accelerators (not shown) dedicated to AI and/or NNprocessing. For example, the logic 182 may include VPUs, and/or otherAI/NN-specific processors, etc. In some embodiments, any aspect of theembodiments described herein may be implemented in the processors and/oraccelerators dedicated to AI and/or NN processing.

FIG. 15 illustrates a processor core 200 according to one embodiment.The processor core 200 may be the core for any type of processor, suchas a micro-processor, an embedded processor, a digital signal processor(DSP), a network processor, or other device to execute code. Althoughonly one processor core 200 is illustrated in FIG. 15, a processingelement may alternatively include more than one of the processor core200 illustrated in FIG. 15. The processor core 200 may be asingle-threaded core or, for at least one embodiment, the processor core200 may be multithreaded in that it may include more than one hardwarethread context (or “logical processor”) per core.

FIG. 15 also illustrates a memory 270 coupled to the processor core 200.The memory 270 may be any of a wide variety of memories (includingvarious layers of memory hierarchy) as are known or otherwise availableto those of skill in the art. The memory 270 may include one or morecode 213 instruction(s) to be executed by the processor core 200,wherein the code 213 may implement and/or perform one or more aspects ofone or more aspects of the process 100 (FIG. 1), method 300 (FIG. 2),process 350 (FIG. 3), process 362 (FIG. 4), neural network 430 (FIG. 7),neural network 510 (FIG. 9A), method 480 (FIG. 10), method 600 (FIG. 11)and method 520 (FIG. 12), already discussed. The processor core 200follows a program sequence of instructions indicated by the code 213.Each instruction may enter a front end portion 210 and be processed byone or more decoders 220. The decoder 220 may generate as its output amicro operation such as a fixed width micro operation in a predefinedformat, or may generate other instructions, microinstructions, orcontrol signals which reflect the original code instruction. Theillustrated front end portion 210 also includes register renaming logic225 and scheduling logic 230, which generally allocate resources andqueue the operation corresponding to the convert instruction forexecution.

The processor core 200 is shown including execution logic 250 having aset of execution units 255-1 through 255-N. Some embodiments may includea number of execution units dedicated to specific functions or sets offunctions. Other embodiments may include only one execution unit or oneexecution unit that can perform a particular function. The illustratedexecution logic 250 performs the operations specified by codeinstructions.

After completion of execution of the operations specified by the codeinstructions, back end logic 260 retires the instructions of the code213. In one embodiment, the processor core 200 allows out of orderexecution but requires in order retirement of instructions. Retirementlogic 265 may take a variety of forms as known to those of skill in theart (e.g., re-order buffers or the like). In this manner, the processorcore 200 is transformed during execution of the code 213, at least interms of the output generated by the decoder, the hardware registers andtables utilized by the register renaming logic 225, and any registers(not shown) modified by the execution logic 250.

Although not illustrated in FIG. 15, a processing element may includeother elements on chip with the processor core 200. For example, aprocessing element may include memory control logic along with theprocessor core 200. The processing element may include I/O control logicand/or may include I/O control logic integrated with memory controllogic. The processing element may also include one or more caches

Referring now to FIG. 16, shown is a block diagram of a computing system1000 embodiment in accordance with an embodiment. Shown in FIG. 16 is amultiprocessor system 1000 that includes a first processing element 1070and a second processing element 1080. While two processing elements 1070and 1080 are shown, it is to be understood that an embodiment of thesystem 1000 may also include only one such processing element.

The system 1000 is illustrated as a point-to-point interconnect system,wherein the first processing element 1070 and the second processingelement 1080 are coupled via a point-to-point interconnect 1050. Itshould be understood that any or all of the interconnects illustrated inFIG. 16 may be implemented as a multi-drop bus rather thanpoint-to-point interconnect.

As shown in FIG. 16, each of processing elements 1070 and 1080 may bemulticore processors, including first and second processor cores (i.e.,processor cores 1074 a and 1074 b and processor cores 1084 a and 1084b). Such cores 1074 a, 1074 b, 1084 a, 1084 b may be configured toexecute instruction code in a manner similar to that discussed above inconnection with FIG. 15.

Each processing element 1070, 1080 may include at least one shared cache1896 a, 1896 b. The shared cache 1896 a, 1896 b may store data (e.g.,instructions) that are utilized by one or more components of theprocessor, such as the cores 1074 a, 1074 b and 1084 a, 1084 b,respectively. For example, the shared cache 1896 a, 1896 b may locallycache data stored in a memory 1032, 1034 for faster access by componentsof the processor. In one or more embodiments, the shared cache 1896 a,1896 b may include one or more mid-level caches, such as level 2 (L2),level 3 (L3), level 4 (L4), or other levels of cache, a last level cache(LLC), and/or combinations thereof.

While shown with only two processing elements 1070, 1080, it is to beunderstood that the scope of the embodiments is not so limited. In otherembodiments, one or more additional processing elements may be presentin a given processor. Alternatively, one or more of processing elements1070, 1080 may be an element other than a processor, such as anaccelerator or a field programmable gate array. For example, additionalprocessing element(s) may include additional processors(s) that are thesame as a first processor 1070, additional processor(s) that areheterogeneous or asymmetric to processor a first processor 1070,accelerators (such as, e.g., graphics accelerators or digital signalprocessing (DSP) units), field programmable gate arrays, or any otherprocessing element. There can be a variety of differences between theprocessing elements 1070, 1080 in terms of a spectrum of metrics ofmerit including architectural, micro architectural, thermal, powerconsumption characteristics, and the like. These differences mayeffectively manifest themselves as asymmetry and heterogeneity amongstthe processing elements 1070, 1080. For at least one embodiment, thevarious processing elements 1070, 1080 may reside in the same diepackage.

The first processing element 1070 may further include memory controllerlogic (MC) 1072 and point-to-point (P-P) interfaces 1076 and 1078.Similarly, the second processing element 1080 may include a MC 1082 andP-P interfaces 1086 and 1088. As shown in FIG. 16, MC's 1072 and 1082couple the processors to respective memories, namely a memory 1032 and amemory 1034, which may be portions of main memory locally attached tothe respective processors. While the MC 1072 and 1082 is illustrated asintegrated into the processing elements 1070, 1080, for alternativeembodiments the MC logic may be discrete logic outside the processingelements 1070, 1080 rather than integrated therein.

The first processing element 1070 and the second processing element 1080may be coupled to an I/O subsystem 1090 via P-P interconnects 1076 1086,respectively. As shown in FIG. 16, the I/O subsystem 1090 includes P-Pinterfaces 1094 and 1098. Furthermore, I/O subsystem 1090 includes aninterface 1092 to couple I/O subsystem 1090 with a high performancegraphics engine 1038. In one embodiment, bus 1049 may be used to couplethe graphics engine 1038 to the I/O subsystem 1090. Alternately, apoint-to-point interconnect may couple these components.

In turn, I/O subsystem 1090 may be coupled to a first bus 1016 via aninterface 1096. In one embodiment, the first bus 1016 may be aPeripheral Component Interconnect (PCI) bus, or a bus such as a PCIExpress bus or another third generation I/O interconnect bus, althoughthe scope of the embodiments is not so limited.

As shown in FIG. 16, various I/O devices 1014 (e.g., biometric scanners,speakers, cameras, sensors) may be coupled to the first bus 1016, alongwith a bus bridge 1018 which may couple the first bus 1016 to a secondbus 1020. In one embodiment, the second bus 1020 may be a low pin count(LPC) bus. Various devices may be coupled to the second bus 1020including, for example, a keyboard/mouse 1012, communication device(s)1026, and a data storage unit 1019 such as a disk drive or other massstorage device which may include code 1030, in one embodiment. Theillustrated code 1030 may implement and/or perform one or more aspectsof the process 100 (FIG. 1), method 300 (FIG. 2), process 350 (FIG. 3),process 362 (FIG. 4), neural network 430 (FIG. 7), neural network 510(FIG. 9A), method 480 (FIG. 10), method 600 (FIG. 11) and method 520(FIG. 12), already discussed. Further, an audio I/O 1024 may be coupledto second bus 1020 and a battery 1010 may supply power to the computingsystem 1000.

Note that other embodiments are contemplated. For example, instead ofthe point-to-point architecture of FIG. 16, a system may implement amulti-drop bus or another such communication topology. Also, theelements of FIG. 16 may alternatively be partitioned using more or fewerintegrated chips than shown in FIG. 16.

ADDITIONAL NOTES AND EXAMPLES

Example 1 includes a computing device comprising a storage device tostore a log of events associated with a computer architecture, agraphics processor, a host processor, and a memory including a set ofinstructions, which when executed by one or more of the graphicsprocessor or the host processor, cause the computing device to identifya sequence of events from the log, categorize, with a natural languageprocessing system, the sequence of events into a sequence of words,identify an anomaly based on the sequence of words, and trigger anautomatic remediation process in response to an identification of theanomaly.

Example 2 includes the computing device of Example 1, wherein theinstructions, when executed, cause the computing device identify wordsfrom the sequence of events based on a vocabulary associated with thecomputer architecture, arrange the identified words into the sequence ofwords, generate at least one sentence based on the sequence of words,conduct a determination that the at least one sentence is to bedissimilar from any sentence structure defined by a domain specificlanguage associated with the computer architecture, and identify theanomaly based on the determination.

Example 3 includes the computing device of Example 1, wherein theinstructions, when executed, cause the computing device to identify thata next word is unable to be predicted based on the sequence of words,and identify the anomaly in response to the next word beingunpredictable.

Example 4 includes the computing device of Example 1, wherein theinstructions, when executed, cause the computing device to generate alevel of response based on the sequence of words, wherein the level ofresponse is to be associated with a quality-of-service measurement, andidentify the anomaly based on the level of response meeting a threshold.

Example 5 includes the computing device of Example 1, wherein theanomaly is to be a deviation from an expected behavior, and theautomatic remediation process is to include an adjustment to one or moreof a hardware parameter to one or more of mitigate or prevent theanomaly or an adjustment to a software parameter to one or more ofmitigate or prevent the anomaly.

Example 6 includes the computing device of any one of Examples 1 to 5,wherein the natural language processing system is to be one or moreneural networks.

Example 7 includes a semiconductor apparatus comprising one or moresubstrates, and logic coupled to the one or more substrates, wherein thelogic is implemented in one or more of configurable logic orfixed-functionality logic hardware, the logic coupled to the one or moresubstrates to identify a sequence of events associated with a computerarchitecture, categorize, with a natural language processing system, thesequence of events into a sequence of words, identify an anomaly basedon the sequence of words, and trigger an automatic remediation processin response to an identification of the anomaly.

Example 8 includes the apparatus of Example 7, wherein the logic coupledto the one or more substrates is to identify words from the sequence ofevents based on a vocabulary associated with the computer architecture,arrange the identified words into the sequence of words, generate atleast one sentence based on the sequence of words, conduct adetermination that the at least one sentence is to be dissimilar fromany sentence structure defined by a domain specific language associatedwith the computer architecture, and identify the anomaly based on thedetermination.

Example 9 includes the apparatus of Example 7, wherein the logic coupledto the one or more substrates is to identify that a next word is unableto be predicted based on the sequence of words, and identify the anomalyin response to the next word being unpredictable.

Example 10 includes the apparatus of Example 7, wherein the logiccoupled to the one or more substrates is to generate a level of responsebased on the sequence of words, wherein the level of response is to beassociated with a quality-of-service measurement, and identify theanomaly based on the level of response meeting a threshold.

Example 11 includes the apparatus of Example 7, wherein the anomaly isto be a deviation from an expected behavior, and the automaticremediation process is to include an adjustment to one or more of ahardware parameter to one or more of mitigate or prevent the anomaly oran adjustment to a software parameter to one or more of mitigate orprevent the anomaly.

Example 12 includes the apparatus of any one of Examples 7 to 11,wherein the natural language processing system is to be one or moreneural networks.

Example 13 includes the apparatus of any one of Examples 7 to 11,wherein the logic coupled to the one or more substrates includestransistor channel regions that are positioned within the one or moresubstrates.

Example 14 includes at least one computer readable storage mediumcomprising a set of instructions, which when executed by a computingdevice, cause the computing device to identify a sequence of eventsassociated with a computer architecture, categorize, with a naturallanguage processing system, the sequence of events into a sequence ofwords, identify an anomaly based on the sequence of words, and triggeran automatic remediation process in response to an identification of theanomaly.

Example 15 includes the at least one computer readable storage medium ofExample 14, wherein the instructions, when executed, cause the computingdevice to identify words from the sequence of events based on avocabulary associated with the computer architecture, arrange theidentified words into the sequence of words, generate at least onesentence based on the sequence of words, conduct a determination thatthe at least one sentence is to be dissimilar from any sentencestructure defined by a domain specific language associated with thecomputer architecture, and identify the anomaly based on thedetermination.

Example 16 includes the at least one computer readable storage medium ofExample 14, wherein the instructions, when executed, cause the computingdevice to identify that a next word is unable to be predicted based onthe sequence of words, and identify the anomaly in response to the nextword being unpredictable.

Example 17 includes the at least one computer readable storage medium ofExample 14, wherein the instructions, when executed, cause the computingdevice to generate a level of response based on the sequence of words,wherein the level of response is to be associated with aquality-of-service measurement, and identify the anomaly based on thelevel of response meeting a threshold.

Example 18 includes the at least one computer readable storage medium ofExample 14, wherein the anomaly is to be a deviation from an expectedbehavior, and the automatic remediation process is to include anadjustment to one or more of a hardware parameter to one or more ofmitigate or prevent the anomaly or an adjustment to a software parameterto one or more of mitigate or prevent the anomaly.

Example 19 includes the at least one computer readable storage medium ofany one of Examples 14 to 18, wherein the natural language processingsystem is to be one or more neural networks.

Example 20 includes a method comprising identifying a sequence of eventsassociated with a computer architecture, categorizing, with a naturallanguage processing system, the sequence of events into a sequence ofwords, identifying an anomaly based on the sequence of words, andtriggering an automatic remediation process in response to anidentification of the anomaly.

Example 21 includes the method of Example 20, further includingidentifying words from the sequence of events based on a vocabularyassociated with the computer architecture, arranging the identifiedwords into the sequence of words, generating at least one sentence basedon the sequence of words, and conducting a determination that the atleast one sentence is to be dissimilar from any sentence structuredefined by a domain specific language associated with the computerarchitecture, and identifying the anomaly based on the determination.

Example 22 includes the method of Example 20, further comprisingidentifying that a next word is unable to be predicted based on thesequence of words, and identifying the anomaly in response to the nextword being unpredictable.

Example 23 includes the method of Example 20, further comprisinggenerating a level of response based on the sequence of words, whereinthe level of response is to be associated with a quality-of-servicemeasurement, and identifying the anomaly based on the level of responsemeeting a threshold.

Example 24 includes the method of Example 20, wherein the anomaly is tobe a deviation from an expected behavior, and the automatic remediationprocess includes an adjustment to one or more of a hardware parameter toone or more of mitigate or prevent the anomaly or an adjustment to asoftware parameter to one or more of mitigate or prevent the anomaly.

Example 25 includes the method of any one of Examples 20 to 24, whereinthe natural language processing system is to be one or more neuralnetworks.

Example 26 includes a semiconductor apparatus comprising means foridentifying a sequence of events associated with a computerarchitecture, means for categorizing, with a natural language processingsystem, the sequence of events into a sequence of words, means foridentifying an anomaly based on the sequence of words, and means fortriggering an automatic remediation process in response to anidentification of the anomaly.

Example 27 includes the apparatus of Example 26, further comprisingmeans for identifying words from the sequence of events based on avocabulary associated with the computer architecture, means forarranging the identified words into the sequence of words, means forgenerating at least one sentence based on the sequence of words, meansfor conducting a determination that the at least one sentence is to bedissimilar from any sentence structure defined by a domain specificlanguage associated with the computer architecture, and means foridentifying the anomaly based on the determination.

Example 28 includes the apparatus of Example 26, further comprisingmeans for identifying that a next word is unable to be predicted basedon the sequence of words, and means for identifying the anomaly inresponse to the next word being unpredictable.

Example 29 includes the apparatus of Example 26, further comprisingmeans for generating a level of response based on the sequence of words,wherein the level of response is to be associated with aquality-of-service measurement, and means for identifying the anomalybased on the level of response meeting a threshold.

Example 30 includes the apparatus of Example 26, wherein the anomaly isto be a deviation from an expected behavior, and the automaticremediation process includes an adjustment to one or more of a hardwareparameter to one or more of mitigate or prevent the anomaly or anadjustment to a software parameter to one or more of mitigate or preventthe anomaly.

Example 31 includes the apparatus of any one of Examples 26 to 30,wherein the natural language processing system is to be one or moreneural networks.

Thus, technology described herein may generate a unique language forevents. The unique language may provide insights into event flows thatmay otherwise be difficult if not impossible to practically detect.Thus, the technology may provide robust analysis that facilitatesidentification and mitigation of potential anomalies. Furthermore, thetechnology may implement a new and enhanced neural network analysis toidentify anomalies and respond accordingly.

Embodiments are applicable for use with all types of semiconductorintegrated circuit (“IC”) chips. Examples of these IC chips include butare not limited to processors, controllers, chipset components,programmable logic arrays (PLAs), memory chips, network chips, systemson chip (SOCs), SSD/NAND controller ASICs, and the like. In addition, insome of the drawings, signal conductor lines are represented with lines.Some may be different, to indicate more constituent signal paths, have anumber label, to indicate a number of constituent signal paths, and/orhave arrows at one or more ends, to indicate primary information flowdirection. This, however, should not be construed in a limiting manner.Rather, such added detail may be used in connection with one or moreexemplary embodiments to facilitate easier understanding of a circuit.Any represented signal lines, whether or not having additionalinformation, may actually comprise one or more signals that may travelin multiple directions and may be implemented with any suitable type ofsignal scheme, e.g., digital or analog lines implemented withdifferential pairs, optical fiber lines, and/or single-ended lines.

Example sizes/models/values/ranges may have been given, althoughembodiments are not limited to the same. As manufacturing techniques(e.g., photolithography) mature over time, it is expected that devicesof smaller size could be manufactured. In addition, well knownpower/ground connections to IC chips and other components may or may notbe shown within the figures, for simplicity of illustration anddiscussion, and so as not to obscure certain aspects of the embodiments.Further, arrangements may be shown in block diagram form in order toavoid obscuring embodiments, and also in view of the fact that specificswith respect to implementation of such block diagram arrangements arehighly dependent upon the computing system within which the embodimentis to be implemented, i.e., such specifics should be well within purviewof one skilled in the art. Where specific details (e.g., circuits) areset forth in order to describe example embodiments, it should beapparent to one skilled in the art that embodiments can be practicedwithout, or with variation of, these specific details. The descriptionis thus to be regarded as illustrative instead of limiting.

The term “coupled” may be used herein to refer to any type ofrelationship, direct or indirect, between the components in question,and may apply to electrical, mechanical, fluid, optical,electromagnetic, electromechanical or other connections. In addition,the terms “first”, “second”, etc. may be used herein only to facilitatediscussion, and carry no particular temporal or chronologicalsignificance unless otherwise indicated.

As used in this application and in the claims, a list of items joined bythe term “one or more of” may mean any combination of the listed terms.For example, the phrases “one or more of A, B or C” may mean A; B; C; Aand B; A and C; B and C; or A, B and C.

Those skilled in the art will appreciate from the foregoing descriptionthat the broad techniques of the embodiments can be implemented in avariety of forms. Therefore, while the embodiments have been describedin connection with particular examples thereof, the true scope of theembodiments should not be so limited since other modifications willbecome apparent to the skilled practitioner upon a study of thedrawings, specification, and following claims.

We claim:
 1. A computing device comprising: a graphics processor; a hostprocessor; and a memory including a set of instructions, which whenexecuted by one or more of the graphics processor or the host processor,cause the computing device to: identify a sequence of events associatedwith a computer architecture, categorize, with a natural languageprocessing system, the sequence of events into a sequence of words, andidentify an anomaly based on the sequence of words.
 2. The computingdevice of claim 1, wherein the instructions, when executed, cause thecomputing device to: trigger an automatic remediation process inresponse to an identification of the anomaly.
 3. The computing device ofclaim 1, wherein the anomaly is associated with a wireless network. 4.The computing device of claim 3, wherein the instructions, whenexecuted, cause the computing device to: determine a quality-of-serviceassociated with the wireless network, wherein the anomaly is associatedwith the quality-of-service.
 5. The computing device of claim 1, whereinthe sequence of events is associated with a plurality of sources.
 6. Thecomputing device of claim 1, wherein the natural language processingsystem includes artificial intelligence that categorizes the sequence ofevents into the sequence of words.
 7. A semiconductor apparatuscomprising: one or more substrates; and logic coupled to the one or moresubstrates, wherein the logic is implemented in one or more ofconfigurable logic or fixed-functionality logic hardware, the logiccoupled to the one or more substrates to: identify a sequence of eventsassociated with a computer architecture; categorize, with a naturallanguage processing system, the sequence of events into a sequence ofwords; and identify an anomaly based on the sequence of words.
 8. Theapparatus of claim 7, wherein the logic coupled to the one or moresubstrates is to: trigger an automatic remediation process in responseto an identification of the anomaly.
 9. The apparatus of claim 7,wherein the anomaly is associated with a wireless network.
 10. Theapparatus of claim 9, wherein the logic coupled to the one or moresubstrates is to: determine a quality-of-service associated with thewireless network, wherein the anomaly is associated with thequality-of-service.
 11. The apparatus of claim 7, wherein the sequenceof events is associated with a plurality of sources.
 12. The apparatusof claim 7, wherein the natural language processing system includesartificial intelligence that categorizes the sequence of events into thesequence of words.
 13. The apparatus of claim 7, wherein the logiccoupled to the one or more substrates includes transistor channelregions that are positioned within the one or more substrates.
 14. Atleast one computer readable storage medium comprising a set ofinstructions, which when executed by a computing device, cause thecomputing device to: identify a sequence of events associated with acomputer architecture; categorize, with a natural language processingsystem, the sequence of events into a sequence of words; and identify ananomaly based on the sequence of words.
 15. The at least one computerreadable storage medium of claim 14, wherein the instructions, whenexecuted, cause the computing device to: trigger an automaticremediation process in response to an identification of the anomaly. 16.The at least one computer readable storage medium of claim 14, whereinthe anomaly is associated with a wireless network.
 17. The at least onecomputer readable storage medium of claim 16, wherein the instructions,when executed, cause the computing device to: determine aquality-of-service associated with the wireless network, wherein theanomaly is associated with the quality-of-service.
 18. The at least onecomputer readable storage medium of claim 14, wherein the sequence ofevents is associated with a plurality of sources.
 19. The at least onecomputer readable storage medium of claim 14, wherein the naturallanguage processing system includes artificial intelligence thatcategorizes the sequence of events into the sequence of words.
 20. Amethod comprising: identifying a sequence of events associated with acomputer architecture; categorizing, with a natural language processingsystem, the sequence of events into a sequence of words; and identifyingan anomaly based on the sequence of words.
 21. The method of claim 20,further comprising: triggering an automatic remediation process inresponse to an identification of the anomaly.
 22. The method of claim20, wherein the anomaly is associated with a wireless network.
 23. Themethod of claim 22, further comprising: determining a quality-of-serviceassociated with the wireless network, wherein the anomaly is associatedwith the quality-of-service.
 24. The method of claim 20, wherein thesequence of events is associated with a plurality of sources.
 25. Themethod of claim 20, wherein the natural language processing systemincludes artificial intelligence that categorizes the sequence of eventsinto the sequence of words.